SEC Finalizes Amendments To Regulation S-P

On 16 May 2024, the Securities and Exchange Commission (SEC) adopted amendments (amendments) to Regulation S-P representing the first major changes to Regulation S-P since its initial adoption in 2000. Although the amendments do not change the substantive privacy policy provisions of the rule, they do impose significant new privacy-related protections and obligations including:

Adoption of Incident Response Program

Requiring brokers and dealers, investment companies, registered investment advisers, funding portals, and transfer agents registered with the SEC or another appropriate regulatory agency (collectively, covered institutions) as defined in the Securities Exchange Act of 1934 (Exchange Act) to adopt written incident response program policies and procedures to address unauthorized access to or use of customer information, including procedures for providing timely notification to individuals affected by an incident involving sensitive customer information.